Class/Module Index [+]

Quicksearch

Rex::Post::Meterpreter::Extensions::Stdapi::Railgun::DLLHelper

shared functions

Public Instance Methods

asciiz_to_str(asciiz) click to toggle source

converts 0-terminated ASCII string to ruby string

# File lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb, line 44
def asciiz_to_str(asciiz)
        zero_byte_idx = asciiz.index("\x00")
        if zero_byte_idx != nil
                return asciiz[0, zero_byte_idx]
        else
                return asciiz
        end
end
assemble_buffer(direction, function, args) click to toggle source

assembles the buffers "in" and "inout"

# File lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb, line 95
def assemble_buffer(direction, function, args)
        layout = {} # paramName => BufferItem
        blob = ""
        #puts " building buffer: #{direction}"
        function.params.each_with_index do |param_desc, param_idx|
                #puts "  processing #{param_desc[0]} #{param_desc[1]} #{param_desc[2]}"
                # we care only about inout buffers
                if param_desc[2] == direction
                        buffer = nil
                        # Special case:
                        # The user can choose to supply a Null pointer instead of a buffer
                        # in this case we don't need space in any heap buffer
                        if param_desc[0][0,1] == 'P' # type is a pointer
                                if args[param_idx] == nil
                                        next
                                end
                        end

                        case param_desc[0] # required argument type
                                when "PDWORD"
                                        dw = param_to_number(args[param_idx])
                                        buffer = [dw].pack('V')
                                when "PWCHAR"
                                        raise "param #{param_desc[1]}: string expected" unless args[param_idx].class == String
                                        buffer = str_to_uni_z(args[param_idx])
                                when "PCHAR"
                                        raise "param #{param_desc[1]}: string expected" unless args[param_idx].class == String
                                        buffer = str_to_ascii_z(args[param_idx])
                                when "PBLOB"
                                        raise "param #{param_desc[1]}: please supply your BLOB as string!" unless args[param_idx].class == String
                                        buffer = args[param_idx]
                                # other types (non-pointers) don't reference buffers
                                # and don't need any treatment here
                        end

                        if buffer != nil
                                #puts "   adding #{buffer.length} bytes to heap blob"
                                layout[param_desc[1]] = BufferItem.new(param_idx, blob.length, buffer.length, param_desc[0])
                                blob += buffer
                                # sf: force 8 byte alignment to satisfy x64, wont matter on x86.
                                while( blob.length % 8 != 0 )
                                        blob += "\x00"
                                end
                                #puts "   heap blob size now #{blob.length}"
                        end
                end
        end
        #puts "  built buffer: #{direction}"
        return [layout, blob]
end
param_to_number(v, win_consts = @win_consts) click to toggle source

parses a number param and returns the value raises an exception if the param cannot be converted to a number examples:

nil => 0
3 => 3
"MB_OK" => 0
"SOME_CONSTANT | OTHER_CONSTANT" => 17
"tuna" => !!!!!!!!!!Exception

Parameter "win_consts" is a WinConstantManager

# File lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb, line 75
def param_to_number(v, win_consts = @win_consts)
        if v.class == NilClass then
                return 0
        elsif v.class == Fixnum then
                return v # ok, it's already a number
        elsif v.class == Bignum then
                return v # ok, it's already a number
        elsif v.class == String then
                dw = win_consts.parse(v) # might raise an exception
                if dw != nil
                        return dw
                else
                        raise ArgumentError, "Param #{v} (class #{v.class}) cannot be converted to a number. It's a string but matches no constants I know."
                end
        else
                raise "Param #{v} (class #{v.class}) should be a number but isn't"
        end
end
str_to_ascii_z(str) click to toggle source

converts ruby string to zero-terminated ASCII string

# File lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb, line 39
def str_to_ascii_z(str)
        return str+"\x00"
end
str_to_uni_z(str) click to toggle source

converts ruby string to zero-terminated WCHAR string

# File lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb, line 54
def str_to_uni_z(str)
        enc = str.unpack("C*").pack("v*")
        enc += "\x00\x00"
        return enc
end
uniz_to_str(uniz) click to toggle source

converts 0-terminated UTF16 to ruby string

# File lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_helper.rb, line 61
def uniz_to_str(uniz)
        uniz.unpack("v*").pack("C*").unpack("A*")[0]
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.